> ## Documentation Index
> Fetch the complete documentation index at: https://docs.finowl.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Data handling and privacy

> What Finowl does with the data you send, and what you need to tell your users.

## What happens to your inputs

| Endpoint | How it is processed | Stored by Finowl |
| - | - | - |
| `breaches/password` | Matched by partial hash only. The full password is never used in the lookup. | Nothing. The password is never logged, stored or returned. |
| `breaches/email` | The email address, processed by Finowl intelligence | Request metadata only |
| `gender/*` | The name, email or username, processed by Finowl intelligence | Request metadata only |

Request metadata is the endpoint, time, status, duration and credit count shown on your dashboard. Finowl does not keep the inputs you send or the results it returns.

## Your responsibilities

<AccordionGroup>
  <Accordion title="Tell users about the lookup" icon="file-lines">
    Email breach checks and gender predictions process personal data. Mention these lookups, and their purpose, in your privacy notice. Finowl intelligence may use vetted sub-processors; contact [support@finowl.co](mailto:support@finowl.co) if you need details for a data processing agreement.
  </Accordion>

  <Accordion title="Sanitize breach descriptions" icon="code">
    The `Description` field of each breach contains HTML. Render it as text or run it through an HTML sanitizer before putting it in a page.
  </Accordion>

  <Accordion title="Treat predictions as estimates" icon="scale-balanced">
    A gender prediction is a statistical estimate from a name, not a fact about a person. Do not use it for decisions that significantly affect people, such as eligibility, pricing or access. Let people state their own gender wherever it matters. See [Reading predictions](/guides/interpreting-predictions).
  </Accordion>

  <Accordion title="Keep passwords out of your logs" icon="eye-slash">
    Finowl never stores passwords, but your own stack might. Make sure request bodies sent to `breaches/password` are excluded from application logs, APM traces and error reports.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.